BSD Portsp5-Image-ExifTool -- code injection via crafted media
ExifTool versions up to 13.53 contain a code injection flaw in the Process_mrld function of lib/Image/ExifTool/GM.pm, reached while parsing JPEG, QuickTime, MOV and MP4 files. When exiftool is invoked with the -ee (extract embedded) option on a crafted file, a local attacker with low privileges can inject code that runs in the Perl runtime context of the exiftool process. The issue is fixed in ExifTool 13.54.
Affected versions
- p5-Image-ExifTool, p5-Image-ExifTool-devel < 13.54
By system
2 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | graphics/p5-Image-ExifTool | 13.10 | vulnerable since 2026-09-24 | |
| OpenBSD | graphics/p5-Image-ExifTool | 13.56 | out of range, by version | |
| NetBSD | graphics/p5-Image-ExifTool | 13.55nb1 | not listed | |
| MidnightBSD | graphics/p5-Image-ExifTool | 13.36_1 | in range, by version | |
| FreeBSD | graphics/p5-Image-ExifTool | 13.55 | fixed | |
| DragonFly | graphics/p5-Image-ExifTool-devel | 13.25 | vulnerable since 2026-09-24 | |
| FreeBSD | graphics/p5-Image-ExifTool-devel | 13.59 | fixed |